Fake Download Sites: How to Find the Official Source

Short answer: Fake download sites, also called lookalike sites, copy the name of a popular free tool, rank in search results or ads, and serve a file the developer never published. Sometimes it is a repackaged copy, sometimes malware. The defense is simple: get the tool from the address the developer publishes, check the repository owner, check the digital signature when there is one, and compare the SHA-256 hash with the one on the official release. The table below lists popular tools with their only official sources, and the lookalikes that developers or security researchers have named.

Why fake download sites exist

Free, popular tools get searched constantly, and many have no marketing budget or no website at all. That leaves room for others to claim the name. The cases below show what they do with it.

• Malware inside a working installer. Malwarebytes reported in February 2026 that 7zip.com, a copy of the real 7-Zip site at 7-zip.org, served a trojanized installer. It installed a working 7-Zip, so most victims noticed nothing, and quietly turned the PC into a residential proxy node. One victim had followed a YouTube build tutorial that named the wrong domain.
• Squatting on project names. The Windhawk maintainer described the fake windhawk.org as part of “a systematic domain-squatting operation targeting open-source software projects.” He made the key point: the problem is that such a site “makes the false impression of an official website, and the download links can be replaced at any time.”
• Files that can be swapped later. The Czkawka developer said the unofficial czkawka.com hosted binaries on its own server rather than GitHub, which makes it “trivially easy for someone to swap them out with malicious versions.” At the time he checked, the files matched the official ones.
• Impersonating a vendor’s app. Zscaler ThreatLabz documented CoffeeLoader malware packed into files named like ASUS Armoury Crate components. XDA reported spotting a questionable Armoury Crate download on the first page of Google results.
• Trading on a trusted name. In May 2026, the Notepad++ developer warned that notepad-plus-plus-mac.org “has absolutely nothing to do with Notepad++.” Notepad++ has never released a macOS version. He later marked the issue resolved.

Official sources for popular Windows tools

This list covers only what we could confirm from the developer or a reputable security source. If a tool’s lookalike column is empty, that means no one has named one publicly. It does not mean every other site is safe.

A note on Fan Control: getfancontrol.com is linked from the developer’s own GitHub README, so it is not a lookalike. We checked before listing it, because a similar-looking domain is not proof of a fake.

How to recognize the official source

1. Start from the project, not from search results

Find the repository or website the developer controls, then follow its download link. After the fake 7-Zip case, BleepingComputer advised avoiding URLs from YouTube videos or promoted search results and bookmarking the download pages of software you use often.

2. Check the GitHub owner, not just “github.com”

A GitHub URL proves nothing by itself. Flyoobe’s developer warns about a separate GitHub account, github.com/flyoobe, that impersonates the project. The real one is github.com/builtbybel/Flyoobe. Read the part after github.com/ character by character.

3. Check the digital signature when the developer signs

Right-click the downloaded file, open Properties > Digital Signatures and read the signer. Rufus, for example, says its executable is signed and the signature should read “Akeo Consulting.” Fan Control’s developer says its executable, installer and updater are now signed.

Read the signer’s name, not just the presence of a signature. BleepingComputer reported that the fake 7-Zip installer was digitally signed, with a certificate issued to an unrelated company and later revoked.

Many small open-source tools are not signed. The current Flyoobe executable is not, for example. No signature doesn’t mean malware, but it does mean the next check matters more.

4. Compare the SHA-256 hash

Since June 3, 2025, GitHub computes a SHA-256 digest for every uploaded release file and shows it on the release page. Compare it with your file:

Get-FileHash .\downloaded-file.zip -Algorithm SHA256

Get-FileHash uses SHA-256 by default. If the two values differ by even one character, it is not the same file. Our app pages, such as Rufus, Flyoobe and Ventoy, show the hashes from each official release.

5. Treat these as red flags

• A payment request for a free tool. OptiScaler’s team says it plainly: “OptiScaler is FREE, any kind of monetary requirements are scams!”
• A different file type than the project ships, such as an .exe or .msi “installer” for a tool the developer ships as a ZIP.
• No link back to the source repository. The Czkawka developer noted that the unofficial site avoided linking to his GitHub page.
• A version number that doesn’t exist on the official releases page.

If you already ran a file from a lookalike site

• Malwarebytes’ advice for the fake 7-Zip case was that any system that ran installers from 7zip.com “should be considered compromised.” Apply the same caution to any unofficial installer.
• Run a full scan with reputable security software. Malwarebytes said such software can detect and remove the components in that case.
• Uninstall the tool and reinstall it from the official source. Verify the hash this time.
• Report the site. The OrcaSlicer README points to Google Safe Browsing and Microsoft’s unsafe-site reporting form for this.

How this site handles downloads

• We never host files. Every download button goes to the developer’s own release or website.
• Version numbers, release dates and SHA-256 values come from the official release. For GitHub projects, that means GitHub’s releases API.
• We name a lookalike only when the developer or a reputable security source has named it, and we link to that statement.

For a worked example of all of this on one tool, see Is Flyoobe safe?. If you’re downloading tools to install Windows 11 on older hardware, our unsupported-PC guide links only to Microsoft and the tools’ official releases.

Questions

Is every site other than the developer’s a fake?

No. Some mirrors are harmless, and some unofficial sites were serving genuine files when developers checked. The risk is that you can’t tell, and the files can change.

Is a site safe if it shows up first on Google?

No. Ranking says nothing about who runs a site. After the 7-Zip case, BleepingComputer specifically warned against following promoted search results for downloads.

Does a GitHub link guarantee a safe download?

Only if it is the developer’s own account. Anyone can create a GitHub account with a project’s name.

What if the developer doesn’t publish hashes?

For files on GitHub releases published since June 3, 2025, GitHub shows a SHA-256 digest automatically. Otherwise, rely on the signature and the official URL.

Is winget safer than a website?

Windows Package Manager manifests list the installer URL and its SHA-256. The Rufus manifest, for example, points to the pbatard/rufus GitHub releases. Check that the manifest’s URL is the official one.

Why don’t you list every lookalike domain?

Because we only publish claims we can source. A domain that merely looks similar may belong to the developer, as getfancontrol.com does.

How do I report a fake download site?

Use Google Safe Browsing’s phishing report and Microsoft’s report-unsafe-site form, and tell the developer through their issue tracker.

Do fake sites only target small tools?

No. Examples above range from 7-Zip and Notepad++ to ASUS’s own software.

Sources

• Fake 7-Zip downloads are turning home PCs into proxy nodes, Malwarebytes (February 9, 2026)
• Malicious 7-Zip site distributes installer laced with proxy tool, BleepingComputer, Bill Toulas (February 10, 2026)
• Flyoobe README (security alert), GitHub
• Developer warns users that fake download site is hosting Windows 11 upgrade bypass tool, Tom’s Hardware (November 2, 2025)
• OrcaSlicer README, GitHub
• Fake Windhawk website, Discussion #900, GitHub (April 3, 2026)
• Is czkawka.com a legit site? Issue #1583 and Czkawka README, GitHub
• Trademark Violation: Fake Notepad++ for Mac, Notepad++ (May 1, 2026)
• OptiScaler README, GitHub
• ExplorerPatcher releases, GitHub
• CoffeeLoader: A Brew of Stealthy Techniques, Zscaler ThreatLabz (March 26, 2025)
• This new malware infects your GPU and looks just like a popular Asus utility, XDA Developers, Jacob Roach (April 4, 2025)
• Fan Control README, GitHub
• Rufus, official site
• Releases now expose digests for release assets, GitHub Changelog (June 3, 2025)
• Get-FileHash, Microsoft Learn
• Rufus.Rufus 4.15 winget manifest, GitHub